IAM Architect

Identity and Access Management (IAM) Architect - JOB DESCRIPTION

Seeking an Identity and Access Management (IAM) Architect. As an IAM Architect, you will own and mature our identity security posture across a complex, multi-platform environment, serving as the primary driver of a structured role‑based access control (RBAC) program and a trusted technical advisor across infrastructure, IT, and development teams. The ideal candidate will have deep experience with Entra , Active Directory, identity lifecycle automation, and governing access in regulated enterprise environments.

• Design and implement enterprise RBAC: Build a cohesive role‑based access control model across Entra , Active Directory, and Entra External , replacing ad hoc access grants with governed, role‑aligned entitlements.
• Lead identity lifecycle automation: Integrate the HR system with Entra  automate provisioning and deprovisioning, ensuring access changes are event‑driven and auditable at the point of hire, transfer, and termination.
• Govern directory structure and access hygiene: Define and enforce naming conventions, group structures, and access review cadences across all directory platforms.
• Manage non‑human identities: Govern service accounts, including managed identities, service principals, and app registrations, enforcing least privilege and credential hygiene across all environments.
• Advise development teams on identity security: Provide architectural guidance on token handling, session management, and federation patterns for teams building or maintaining identity‑adjacent systems.
• Drive Conditional Access and PIM: Lead Conditional Access policy design and own Privileged Identity Management configuration and the privileged access model for admin roles across Azure and M365.
• Support Entra External : Advise teams on External t configuration, custom policy, user flows, and external identity federation.
• Produce compliance‑ready documentation: Maintain IAM documentation including access control matrices, provisioning runbooks, and audit‑ready entitlement inventories supporting FCRA and FTC Safeguards Rule obligations.
• Collaborate across the security program: Align IAM initiatives with the broader security roadmap and participate in change management and architecture review processes alongside security engineers and the Cybersecurity Manager.

• 5+ years of hands‑on IAM engineering experience, with at least 3 years focused on Entra  (Azure AD) in enterprise environments.
• Deep working knowledge of Active Directory, including group policy, OU design, domain trust models, and hybrid identity patterns.
• Demonstrated experience designing and implementing RBAC models at scale in complex or legacy environments.
• Hands‑on experience with Entra , including access reviews, entitlement management, lifecycle workflows, and Privileged Identity Management (PIM).
• Strong working knowledge of OAuth 2.0, OIDC, and SAML, sufficient to review developer implementations and identify security risk.
• Practical experience automating identity lifecycle events using Logic Apps, Azure Functions, Power Shell, or the Microsoft Graph API.
• Ability to communicate risk clearly to non‑technical stakeholders and produce compliance‑ready documentation.
• Will accept any suitable combination of education, training, or experience.

• Experience in regulated industries such as financial services, fintech, or automotive with access control obligations.
• Familiarity with FTC Safeguards Rule requirements or equivalent data security regulatory frameworks.
• Prior experience integrating an HRIS platform (Workday, BambooHR, UKG, or similar) with Entra  SCIM or custom connector.
• Exposure to IGA platforms such as SailPoint, Saviynt, or Omada.
• Experience advising development teams on token validation, scope design, role claims, and secure session management.
• Bachelor's degree in Computer Science, Information Systems, or a related field, or equivalent professional experience.
• Relevant certifications: SC‑300 (Microsoft Identity and Access Administrator), AZ‑500 (Microsoft Azure Security Technologies), or equivalent.